The present invention is generally directed to a system and method for providing secure cryptographic functions on a single chip. The present invention is also described herein as providing secure Cryptography On A CHip (COACH). From a general viewpoint, the present invention provides a secure method for establishing secure communications between the outside world and the internals of a cryptographic system capable of accessing and utilizing a plurality of cryptographic engines and adaptable algorithms for controlling and utilizing these engines. More particularly, the present invention employs a single chip which includes a field programmable gate array (FPGA) to provide this enhanced and flexible cryptographic functionality in a secure manner and environment. In another aspect of the present invention, communication is provided to an external memory which is controllably dividable into secure and nonsecure portions. In further aspects of the present invention additional power and flexibility is provided through the use of multiple COACH systems which, because of the secure ways of providing communication to levels of functionality deep within each chip, can now interact amongst themselves in a secure fashion as well as individually, thus providing methods for cross checking and double checking the functioning of individual COACH systems. On another level, the present invention also provides a secure mechanism for programming an FPGA.
The present invention may also be viewed from an entirely different perspective. In particular, the present chip may be viewed as a processor or set of processors access to the functionality of which is securely controlled. It is also to be noted that, in this regard, one or more of the included processors may be a digital signal processor. Such an arrangement is useful for the secure control of digital media including voice, sound and video. Other types of processing elements may also be included. In this view, the fundamental components on the chip are the processors and the cryptographic engines deployed therewith are present in order to provide secure and/or authorized control of the processing elements. On the other hand, as viewed from the perspective first presented above, the central elements comprise cryptographic engines which are controllable in a wide variety of fashions, the goal of which is to provide cryptographic functions, such as encoding, decoding and the primitive operations of modular arithmetic, particularly modular exponentiation.
The present invention may yet be viewed from a third perspective. In this view, the main component is the FPGA portion. In this regard the present invention provides a mechanism for programming this component from outside the chip. In particular, the FPGA programming is now capable of being carried out in a secure manner. The authorization for modifying any FPGA component is protected by secure cryptographic functions. Existing FPGA data can neither be discerned nor modified, except as specifically authorized in accordance with encoded information stored within the device in a volatile memory which is erased if tampering is discerned.
The art of cryptography has been employed at least since the time of Caesar in ancient Rome to provide a secure method of communication. In the modern world cryptography has taken on an equally important role particularly in securing worldwide financial transactions. The structures of modern cryptographic systems have also expanded the role of cryptography so as to also permit the use of cryptographic engines for the purposes of authentication, verification and trusted transaction processing. The fulfillment of these roles has been provided in many different ways but with all of these ways having the common feature that they are designed to prevent one or another forms of attack. These attacks can be either physical in nature or algorithmic. From the point of view of the algorithms and programming that have been deployed in the service of secure communications, protection against attack has typically been enhanced through the use of cryptographic keys of ever increasing length chosen to outmatch the increasing power of data processing systems used to break cryptographic codes. From the point of view of hardware attacks, many different methods have been employed to provide physical security. These include systems which detect attempts at physical or electrical intrusion and self-destruct as a result of these intrusion attempts.
One of the physical systems for protecting cryptographic circuit chips involves the inclusion of a mesh that surrounds the chip. This mesh detects attempts at physical intrusion to the chip. However, the presence of the mesh introduces problems of heat dissipation since it inhibits the flow of thermal energy from the interior regions of the chip to the outside of the mesh. The presence of the mesh structure thus serves to prevent the inclusion of more powerful and denser chip circuits, processors and components, since such inclusions mean an increase in power dissipation which could result in component failure or reliability problems due to the increased heat whose removal is impeded by the mesh. Another disadvantage of using a mesh for tamper detection is that its use requires the inclusion of a number of analog devices; such devices are not easily integrated on the same circuit substrate as digital components and even if they were easy to incorporate, the heat dissipation problems would still remain.
Since the present invention relates to cryptographic processing systems and, even more particularly to systems of this nature implemented with integrated circuit chips, it is useful to point out the existence of the Federal Information Processing Standards (FIPS) publication titled “Security Requirements for Cryptographic Modules” (FIPS PUB 140-2 issued May 25, 2001 which supersedes FIPS PUB 140-1 dated Jan. 11, 1994). This publication discusses four levels of security from the lowest level of security (Security Level 1) to the highest level of security (Security Level 4). The present invention is capable of implementing the highest level of security described therein. An example of a Security Level 1 cryptographic module is described therein as being represented by a Personal Computer (PC) encryption board. Security Level 2 goes further in that it requires that any evidence of an attempt at physical tampering be present. Security Level 3 goes even further in that it attempts to thwart any attempts at tampering. This level of security also requires identity-based authentication mechanisms. Security Level 3 also requires that the input or output of plaintext “critical security parameters” (that is, “CSPs” such as unencrypted key information, which for single pass encryption processes may be human readable) to be performed through ports that are physically separated from other ports or interfaces. In Security Level 4 a complete envelope of protection around the cryptographic module is provided with the intent of detecting and responding to all unauthorized attempts at physical access with the penetration of the module enclosure resulting in the immediate zeroization of all plaintext critical security parameters.
Certain terms, abbreviations and acronyms are used in the present application. These terms are well understood in the arts of cryptography and integrated circuit chip design. Nonetheless, for convenience they are presented in the two tables below as an aid to the reader:
TABLE IASICApplication Specific Integrated CircuitCOACHCryptography On A CHipFIPSFederal Information Processing StandardsFIPS 140-2NIST Standard: Security Requirements forCryptographic ModulesFLASHNonvolatile memoryFPGAField Programmable Gate ArrayeDRAMembedded Dynamic Random Access MemoryMD5Message Digest (Hash) algorithm (by RIVEST; RSASecurity)NISTNational Institute of Standards and TechnologyPCIPeripheral Computer InterconnectTRNGTrue Random Number GeneratorSHAMessage Digest (Hash) algorithm [NIST FIPS 180-2]UTCCoordinated Universal Time (worldwide system of civiltimc basis)
TABLE IIChip HardwareManufactures the chip hardware with the chipManufacturerprivate and public key as well as theChip Vendor's public key (in fuses).Chip HardwareWill place the chip on a card, board or anVendor/Resellerother chip carrier. Creates the FPGAfile encrypted under the Chip Vendor'sprivate key and encrypts the file withthe Chip public key again.Platform ManufacturerInstalls the chip (on card) into the platform andattaches the batteries at the customer site (orplatform manufacturer site). Loads the encryptedFPGA code (netlist) followed by loadingthe encrypted, different code layers includingthe Kernel (Operating System) and usagespecific software code (to enable, amongother things, API calls).Chip Software VendorSelects/enables the options for the SWcryptographic functions of the chip.(cryptographic APIs, performance feature, levelof security, On-Demand feature, leasing andbilling modes).
MD5 (Message Digest 5) is used, for example, in digital signature generation where large data blocks (the message) is to be compressed in a secure manner. PCI is a local (internal) computer bus standard promoted by Intel, Inc. True random numbers are typically generated by sampling and processing hardware noise. For high security environments the random numbers are generated inside the secured boundary.
The present invention is not limited to the use of any particular cryptographic engine. In fact, the present invention may employ a plurality of distinct cryptographic engines. In this regard, it should be understood that, as used herein, the term “cryptographic engine” refers to any circuit designed to perform modular exponentiation or any other cryptographic algorithm. Modular exponentiation is the same as the normal exponentiation process except that the result is taken modulo a large number, which is a prime number so as to be operable to provide encryption and decryption operations.
One of the other features that one would wish to have in a cryptographic system is a higher level of reliable operation than is employed for secure and also for nonsecure transactions. One would also like to be able to employ existing processor designs for incorporation within the structure of a single chip. Clearly, the single chip architecture is much to be preferred since it presents a much more well-defined and defendable boundary. However, extant processors that could be employed to provide on-chip data processing and computational flow typically do not always incorporate the desired level of redundancy. Hence, the use of these processor designs, without more, fails to provide the correspondingly desired level of data integrity and reliability. Likewise, availability and serviceability may also be affected. Accordingly, in preferred embodiments of the present invention, parity is encrypted along with any processor instructions that are written to the external memory. Additionally, when encrypted instructions stored in the “safe” area of the external memory are decrypted, the parity is then checked for data correctness. The inclusion of the parity bit with the instruction makes attacks very difficult since not only is the parity likely to be affected, but it is also the case that the decrypted instruction will be determined to have been tampered with. The failure of a parity check subsequent to instruction decryption provides a good indication that processing should be stopped and/or that an attempted attack has occurred. Stopping at this point promotes continued confidentiality and data integrity.
One of the many problems that one would like to solve in the context of developing a new cryptographic processor is the presence of a large number of applications relating to encryption, decryption, authentification and verification. If these applications were to be stored in their clear form outside of a secure boundary, they would be easy targets for an attack. In these situations code can be changed in the non secure memory and the new code used to access secret data contained within the “secure” boundary. This is clearly an undesirable result and at best precludes the use of legacy code. Accordingly, the present invention provides access to an external memory which includes two portions: one devoted to encrypted data and another devoted to unencrypted data (that is, to “data in the clear” or what is the same, to “clear data”). The boundary between these two memory portions is adjustable but only from within the secure COACH boundary.
The system described herein provides a number of distinct advantages. For example, the invention provides a completely integrated environment in which it is not necessary to expose any unencrypted signals to any other system component such as buses or internal memory interfaces. Access to other secure external COACH systems is still encrypted but the secrets used during encryption are kept within the same physical enclosure as the encryption engine. In nonintegrated cryptographic systems, secure and persistent storage, a CPU (Central Processing Unit or, more simply, processor) must all be provided within some form of unitary, physically protected enclosure, that is, when the components of the cryptographic processing system are discrete, the physical protection scheme for the system must not only protect the discrete components themselves against attack, the physical security scheme must also protect all of the signal paths between these units. It is noted, however, that it is not only the signal paths that must be protected; the power connections must also be protected in nonintegrated solutions since attacks can also be based upon the removal or altering of power line levels directed to only one of the components, which thus renders the entire system vulnerable. In contrast, in the present invention, the cryptographic processing system components exist on the same circuit chip and are thus naturally coupled. No outside circuitry is needed to insure security such as might be provided by a separate circuit which detects tampering and performs a zeroing of RAM and/or other related buffers and registers.